Last updated: 2026-05-25 · Version 1.0
Sub-processors
Last updated: 2026-05-25
Version: 1.0
This page lists the third-party service providers ("sub-processors") that LetsLoop Ltd uses to deliver the Service. Each is bound by a data-processing agreement and processes personal data only on our instructions, for the purposes set out below.
We publish this list to comply with our transparency obligations under UK GDPR Article 28. If we add or change a sub-processor, we will update this page and — where the change is material — notify you in-app or by email at least 14 days before it takes effect.
For the legal bases on which we rely to share data with each sub-processor, see the Privacy Policy.
Active sub-processors
| Sub-processor | Service | Country of processing | Categories of data |
|---|---|---|---|
| Supabase Inc. | Database (Postgres), authentication, file storage, realtime messaging | United States; EU regions available | Account data, profile data, communications data, usage data, technical data |
| Vercel Inc. | Website hosting, serverless API routes, global edge delivery | United States / global edge | Technical data (IP, user agent), API request data, error logs |
| Resend, Inc. (sending infrastructure on Amazon SES) | Transactional email (welcome, notifications, support) | United States (Resend); Amazon SES EU-West-1, Ireland (send infrastructure) | Email address, name, email content, delivery metadata |
| PostHog, Inc. | Product analytics, session replay, feature flags | EU Cloud — Frankfurt, Germany | Analytics events, session data, pseudonymous identifiers (consent-gated) |
| Sentry / Functional Software, Inc. | Error and crash reporting | United States | Crash and error data, technical context (browser, OS, URL, stack trace), pseudonymous user ID |
| LiveKit, Inc. | Real-time voice and video call infrastructure | United States | Call metadata (participants, duration, start/end timestamps). We do not record audio or video streams. |
| Expo / 650 Industries, Inc. | Mobile-app build infrastructure, over-the-air updates, push-notification dispatch | United States | Device tokens for push delivery; build artefacts (no end-user personal data) |
| Apple Inc. | Push-notification delivery on iOS (Apple Push Notification service) | United States; global edge | Device tokens, notification payload |
| Google LLC | Push-notification delivery on Android (Firebase Cloud Messaging) | United States; global edge | Device tokens, notification payload |
| Cloudflare, Inc. | DNS, DDoS protection for letsloop.app | United States; global edge | DNS query data, IP address |
| Vercel Analytics (operated by Vercel Inc.) | Privacy-preserving website traffic analytics | United States / global edge | Aggregated, cookieless traffic data (no IP storage, no persistent identifiers) |
International transfers
Several of the providers above are headquartered in the United States. For transfers of personal data outside the United Kingdom, we rely on safeguards approved under UK GDPR — primarily:
- the UK International Data Transfer Agreement (IDTA), or
- the UK Addendum to the EU Standard Contractual Clauses (SCCs), or
- adequacy regulations where they apply (including the UK-US Data Bridge under the UK extension to the EU-US Data Privacy Framework for participating providers).
You may request a copy of the specific transfer mechanism for any sub-processor by emailing privacy@letsloop.app.
Sub-processors we used to use and have removed
(none yet)
Notifying us of an objection
If you object to a new sub-processor on substantial data-protection grounds, please email privacy@letsloop.app within 14 days of the change being announced. We will discuss it with you in good faith.
Contact
Questions about this list: privacy@letsloop.app
LetsLoop Ltd 71-75 Shelton Street, London WC2H 9JQ, United Kingdom Company number 17178512 (registered in England and Wales)